FUNCTIONAL SAFETY OF ELECTRICAL INSTALLATIONS IN INDUSTRIAL PLANTS BY OTTO WALCH Troublefree and safe operation of industrial systems is of great importance, not only for the safety of the systems and of the personnel, but also for the economic success of a company. Adverse effects on operation can be manifold, for example: _ Malfunctions or failures in a process control system _ Power failure _ Overheating of machine bearings _ Dangerous rise of temperature in a container _ Failure of an emergency off switch To avoid any consequential damage, the term "Functional safety" was introduced in electrical engineering. Functional safety is subject to a probability consideration for each individual device or for a complete loop, as errors cannot be determined in advance. They depend not only on the quality of the devices and systems, but also on the conditions of use, on operating conditions and on environmental conditions. This is why, based on the large number of details to be observed for complying with functional safety, applicationspecific guidelines and standards have been drawn up, the most important are listed in the following: DIN EN 61508 Functional safety of electrical/electronic/ programmable electronic safetyrelated systems; Part 17 DIN EN 61511 Functional safety Safety Instrumented Systems for the process industry sector; Parts 13 DIN EN ISO 13849 Safety of machinery Safetyrelated parts of control systems; Parts 13 DIN EN 62061 Safety of machinery Functional safety of safetyrelated electrical, electronic and programmable electronic control systems DIN EN 50495 Safety devices required for the safe functioning of equipment with respect to explosion risks In addition to the standards listed here, there are also further standards and essays on the topic "Use of safety equipment". As examples, guidelines for the use of safety equipment in vehicles, in nuclear power plants or in railway applications are mentioned. 34 EXMAGAZINE 2014
FUNCTIONAL SAFETY OF ELECTRICAL INSTALLATIONS IN INDUSTRIAL PLANTS SAFETY INTEGRITY LEVEL PROBABILITY OF FAILURE ON DEMAND PER YEAR PFD PROBABILITY OF A DANGEROUS FAILURE PER HOUR (H 1) PFH RISK REDUCTION BY A FACTOR OF SIL 4 >= 10 5 10 9 to < 10 8 100.000 to 10.000 SIL 3. >=10 4 to < 10 3 10 8 to < 10 7 10.000 to 1.000 SIL 2 >=10 3 to < 10 2 10 7 to < 10 6 1.000 to 100 SIL 1 >=10 2 to < 10 1 10 6 to < 10 5 100 to 10 TABELLE 1 Classification of the SIL values according to probability and frequency of dangerous failures DIN EN 61508 This standard is a basic standard for safety considerations. This is where the SIL classification comes from. SIL stands for Safety Integrity Level. This standard defines the SIL value and subdivides it into four levels. The determination of the SIL value specified here applies to the complete safety system. This is why for the determination of the SIL the data for all components of the safety loop is composed of must be available. Examples for increasing functional safety include redundant components or circuits and limit switches that respond in case of malfunctions. The standard 61511 applies in particular to the users of safety systems in the process industry. Since this essay discusses mainly the determination of the SIL value, the standard DIN EN 61511 will only be mentioned briefly. An important factor is that, in addition to systematic and random faults, the fault tolerance must also be considered, for which measures have been specified as to how the safety equipment must be designed and used. These measures must always be taken simultaneously. The term "Proven in Use" will also be discussed. This term is defined in the standard DIN EN 61508. For many components used in safety applications, the specification of DIN EN 61508 was not yet known or had not been observed when these components were developed. Nor were the values required for the SIL calculation known. To be able to use these components despite this, another standard, DIN EN 61511, allows for this option, and the operator must take responsibility accordingly. The NAMUR (NormenAusschuss Mess und Regelungstechnik, Committee for Standardization in Measurement and Control Technology) recommendation NE 130, in which these specifications of DIN EN 61511 have been incorporated in detail, should be mentioned in this context. The safety equipment is classified (evaluation of SIL value) according to TABLE 1. As a differentiating factor for which value is to be used, the demand rate is used. In Low Demand Mode (demand for safety equipment maximum once a year), the PFD value must be used, but in High Demand or Continuous Mode the PFH value must be used. For the classification to determine the SIL value of a safety device the following tables have to be considered as well. To do so, the safety device must be first classified as type A or type B. The definition for type A states that the malfunction must be defined for all components used. Safety devices for which the malfunction has not been defined as type A (TABLE 2) or whose function depends on software must be declared as type B (TABLE 3). The corresponding table must then be used depending on this definition. The term Safe Failure Fraction (SFF) is a value that shows how many of the failures, relative to the total number of failures, are to be considered safe failures. SFF = 1 undetected, dangerous failures all failures Example: at an SFF 99 % more than 99 % of the failures must be declared as safe failures and, vice versa, a maximum of 1 % of all failures may be undiscovered dangerous. The Hardware Fault Tolerance (HFT), also known as redundancy, indicates how many safety functions are in use simultaneously. Example: if two safety functions are in use simultaneously (HFT = 1), the safety function is still guaranteed if one of the two fails. This standard provides two options of determining safety characteristic values for a safety device. One is development using the complete service life of the safety device. The other option is to determine the values according to an FMEDA (Failure Modes, Effects and Diagnostic Analysis) for already existing products used in safety applications. The service life of a safety device starts with the concept and ends, via the hazard assessment, the determination of the safety requirements, the development, the implementation, and the operation of the safety systems, with the decommissioning. This shows that this standard applies predominantly to the manufacturers of safety systems or their components. è EXMAGAZINE 2014 35
SAFE FAILURE FRACTION (SFF) HARDWARE FAULT TOLERANCE (HFT) 0 1 2 < 60% SIL 1 SIL 2 SIL 3 60% < 90% SIL 2 SIL 3 SIL 4 90% < 99% SIL 3 SIL 4 SIL 4 99% SIL 3 SIL 4 SIL 4 TABLE 2 SIL values as a function of SFF and HFT for type A SAFE FAILURE FRACTION (SFF) HARDWARE FAULT TOLERANCE 0 1 2 < 60% Not permitted SIL 1 SIL 2 60% < 90% SIL 1 SIL 2 SIL 3 90% < 99% SIL 2 SIL 3 SIL 4 99% SIL 3 SIL 4 SIL 4 TABLE 3 SIL values as a function of SFF and HFT for type B DIN EN 62061 Furthermore, the following values of the safety circuit must be defined: _ clear safety function _ safe status of the system (FailSafe) _ dangerous status of the system (Fail Dangerous) An example of the FailSafe status is switching off the electrical energy of an explosionprotected electrical apparatus, which in case of failure would result in an increased surface temperature. An example of the Fail Dangerous status is when a level monitoring unit does not switch off the medium supply in case of failure, resulting in overfilling of the container to be monitored. All other values listed in the standard will not be considered in this document. 36 EXMAGAZINE 2014 This standard applies to the machine industry. Here, too, the SIL value is used in the same way as in the standard series DIN EN 61508. The service life in this standard is defined in the same way as in DIN EN 61508, but in this standard it ends with the modification of the components used. In DIN EN 61508 everything, including the decommissioning of the safety equipment, is regarded as service life. This standard discusses in detail which SIL value must be used for the application in question. This specification is based on risk assessment. It determines which SIL value the safety equipment must fulfil as a function of the "extent of the damage" and "probability of the damage to occur". The extent of the damage, also referred to as severity of the damage, is subdivided into the following 4 levels: 1 reversible 2 reversible by medical treatment 3 hardly reversible or easily irreversible 4 very severe or irreversible (death, ) The class of probability or the probability of the damage to occur is the sum of the following 3 individual levels: _ Avoidance (P) having the values 15 (how can the damage be avoided) _ Probability (W) having the values 15 (with which probability will the fault occur) and _ Frequency / duration having the values 25 (how often or for how long will the fault occur) which can adopt a value of between 4 and 15. These values can then be used to determine the required SIL value from TABLE 4. è
FUNCTIONAL SAFETY OF ELECTRICAL INSTALLATIONS IN INDUSTRIAL PLANTS SEVERITY CLASS 3 TO 4 5 TO 7 8 TO 10 11 TO 13 14 TO 15 4 SIL2 SIL 2 SIL 2 SIL 3 SIL 3 3. Other measures SIL 1 SIL 2 SIL 3 2 Other measures SIL 1 SIL 2 1 Other measures SIL 1 TABLE 4 SIL values determined via risk assessment PL SIL a no SIL Wert b SIL 1 c SIL 2 d SIL 3 e SIL 4 TABLE 5 Comparison of SIL and PL EXMAGAZINE 2014 37
S1 S2 PL a PL b PL c PL d PL e FIGURE 1 Risk graph for determining the PL value DIN EN ISO 13849 DIN EN 50495 This standard also applies to the machine industry. The main difference to DIN EN 61508 is that instead of the SIL value the Performance Level (PL), which is divided into 5 levels, is used. In this standard, the relationship between the Performance Level (PL) and Safety Integrity Level (SIL) is listed in tabular form. TABLE 5 shows that the Performance Level c can correspond to a SIL 2 value (or also vice versa). However, in order to be able to apply this table, all specifications of the other standard must be taken into consideration. Provided that the existing values were determined in compliance with the standard, when SIL is converted into PL, the requirements of DIN EN 13849 and, when PL is converted into SIL, those of DIN EN 61508 must be additionally met. This standard defines the risk graph and its use. To determine the required PL for the application using this risk graph (FIGURE 1), the following values must be predefined. S: Severity of the injury: S1 = light, reversible injuries S2 = serious injury, death F: Frequency or duration of exposure to the hazard = rarely to less frequently and/or less frequently or time of exposure to the hazard is short, F2 = frequently to permanently and/or time of exposure to the hazard is long P: Possibility to avoid the hazard or limit the damage = possible under certain conditions = hardly possible All these values must then be entered in the risk graph, in order to determine the required PL value. Both the risk graph and the risk assessment described in the standard DIN EN 62061 must be performed by the user of the safety device. In this standard, the two different safety considerations, the calculation via the probability (functional safety), and the predefined failure consideration for explosion protection are applied. The scope of this standard is to use safety monitoring designed in accordance with functional safety to monitor a potential ignition source, for example at the bearing of a machine, and thus to have the complete application certified for use in the corresponding Zone. The term Zone is defined in the standard DIN EN 600790 and states how high the risk of the existing explosive atmosphere is. In Zone 0, the explosive atmosphere can be present continuously or for long periods, but in Zone 2 only rarely and for a short period. This standard is not a new type of protection (see DIN EN 600790). It is intended to be used for monitoring an ignition source that cannot be monitored using the traditional types of protection by means of a safety monitoring unit using the corresponding specifications. The exact requirements are listed in TABLE 6. To give an example: An Ex device has been certified for Zone 2, but safety is only guaranteed for use in this zone. To meet the requirements of certification for Zone 1, safety must also be guaranteed under defined failure conditions. Monitoring the behaviour under failure conditions can be achieved by means of a safety device which has a fault tolerance of 0 and a SIL value of 1. 38 EXMAGAZINE 2014
FUNCTIONAL SAFETY OF ELECTRICAL INSTALLATIONS IN INDUSTRIAL PLANTS HAZARDOUS AREA ZONE 0 ZONE 1 ZONE 2 EUC Fault tolerance 2 1 0 1 0 0 Safety device Fault tolerance SILValue O SIL 1 1 SIL 2 0 SIL 1 Combined system Category 1 2 3 TABLE 6 Requirements of safety devices according to the SIL qualification or according to the category of the equipment in accordance with the explosion protection regulations CONCLUSION The complete combination Equipment Under Control (EUC) and the safety device must meet the Ex requirements of the desired category and be certified by a Notified Body. At present, this standard is only valid as an European Standard. There is currently work underway to make this standard an IEC standard. The present essay shows that functional safety plays an important role in safe and troublefree operation of industrial systems. In this context for Hazardous Locations there must be full compliance with the relevant equipment and installation standards and regulations (in Europe the ATEX directive). AUTHOR OTTO WALCH [HEAD OF INTERNATIONAL CERTIFICATION / TEST LABORATORY, R. STAHL SCHALTGERÄTE GMBH, WALDENBURG/GERMANY] LITERATURE DIN EN 61508 Functional safety of electrical/electronic/ programmable electronic safetyrelated systems, Part 17 DIN EN 61511 Functional safety Safety Instrumented Systems for the process industry sector; Parts 13 DIN EN ISO 13849 Safety of machinery Safetyrelated parts of control systems; Parts 13 DIN EN 62061:201309 Safety of machinery Functional safety of safetyrelated electrical, electronic and programmable electronic control systems DIN EN 50495:201010 Safety devices required for the safe functioning of equipment with respect to explosion risks Directive 94/9/EC ATEX directive DIN EN 60079 Part 1 ff Construction and installation standards for explosionprotected electrical equipment and installations NE130 (NAMUR) "Prior use"devices for Safety Instrumented Systems and simplified SIL Calculation EXMAGAZINE 2014 39